CVE-2026-89319 — JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / s…

CVE-2026-89319 concerns an unchecked _thales_aad length header in JweDirectDecryptorBlock.Decrypt. According to the CERT title, a forged tag can reach this condition and lead to an index-out-of-range situation. The source classifies it as CWE-129: Improper Validation of Array Index.